This morning i tried to move an existing logstash to use Centralised Management.
I configured the logstash yml as per documentation.
xpack.management.enabled: true
xpack.management.pipeline.id: ["{pipeline-id}"]
xpack.management.elasticsearch.username: "{username}"
xpack.management.elasticsearch.password: "{password}"
xpack.management.elasticsearch.hosts: ["{elastic host}"]
I used the details directly from the existing pipelines output: username, password, elastic hosts.
I confirmed {username} has:
logstash_admin
logstash_writer
as per:
https://www.elastic.co/guide/en/logstash/7.x/logstash-centralized-pipeline-management.html
On restarting - I saw these errors in the logs (Note; I've replaced our host with {host}):
Unable to retrieve license information from license server {:message=>"Elasticsearch Unreachable: [https://{host}/][Manticore::ClientProtocolException] {host} failed to respond"}
Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.
In case this was a red herring - I configured pipelines in Kibana using the pipeline.id from logstash.yml config. i.e. {pipeline-id} above.
and copied the existing file based config input, filter, and output for this this pipeline, into Kibana.
No data arrived in Elastic. And same error is written to logstash logs...
I read on another post that there was a bug in logstash 7.6.0 with same error, so I updated logstash to 7.9.0
Still the same error is logged.
In the logs it reports that it is starting the pipeline and it is using: central pipeline management:
"pipeline.sources"=>["central pipeline management"
And the pipeline starts...
I have also tried using a super user account.
I have reverted the changes to logstash yml, and now data is appearing - as per the pipeline.yml, but going forwards, we would like to use this feature.
Any help diagnosing appreciated.
Thanks